v0.1.25

kars v0.1.25

Pre-built, cosign-signed artefacts — run kars with no compile,
no AGT clone:

# install the CLI from npm (SLSA build-provenance attested)
npm i -g @kars-runtime/cli
# …or the one-line installer:
# curl -fsSL https://raw.githubusercontent.com/Azure/kars/main/install.sh | bash
kars dev --release

Every container image is cosign keyless-signed (verifiable in the
Sigstore Rekor transparency log), ships an SPDX SBOM, and carries
a GitHub build-provenance (SLSA) attestation; the npm CLI is
provenance-attested too (npm audit signatures).

The downloadable release assets are signed. SHA256SUMS lists
every asset's hash, and is cosign keyless-signed
(SHA256SUMS.cosign.bundle) + build-provenance attested:

# integrity
sha256sum -c SHA256SUMS
# cosign signature of the manifest
cosign verify-blob --bundle SHA256SUMS.cosign.bundle \
  --certificate-identity-regexp '^https://github.com/Azure/kars/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com SHA256SUMS
# SLSA provenance of the manifest
gh attestation verify SHA256SUMS --repo Azure/kars

These images bundle a kars build of the AGT mesh SDK pending
upstream microsoft/agent-governance-toolkit#3128.

Publishing to crates.io / MCR is in progress (see
docs/PUBLISHING.md) — the signed
GHCR images + npm CLI here are usable today.

Container images (PUBLIC GHCR)

Multi-arch linux/amd64,linux/arm64 — runs natively on Apple Silicon:

ghcr.io/azure/kars-controller:v0.1.25
ghcr.io/azure/kars-inference-router:v0.1.25
ghcr.io/azure/kars-a2a-gateway:v0.1.25
ghcr.io/azure/kars-conformance-runner:v0.1.25
ghcr.io/azure/kars-sandbox-base:v0.1.25
ghcr.io/azure/openclaw-sandbox:v0.1.25

Runtime adapter images (PUBLIC GHCR, amd64)

For kars add --runtime <name>. Each bundles the upstream AGT
governance wheels + kars-agt-mesh (kars's spec-compliant Python
MeshClient):

ghcr.io/azure/kars-runtime-langgraph:v0.1.25
ghcr.io/azure/kars-runtime-hermes:v0.1.25
ghcr.io/azure/kars-runtime-maf-python:v0.1.25
ghcr.io/azure/kars-runtime-anthropic:v0.1.25
ghcr.io/azure/kars-runtime-openai-agents:v0.1.25
ghcr.io/azure/kars-runtime-pydantic-ai:v0.1.25

AGT mesh images (PUBLIC GHCR, multi-arch)

The relay + registry that kars dev/up run for the mesh:

ghcr.io/azure/kars-agentmesh-relay:v0.1.25
ghcr.io/azure/kars-agentmesh-registry:v0.1.25

All signed with cosign keyless (verify via Sigstore Rekor). SBOMs
attached below.

What's Changed

• fix(spawn): sub-agents inherit parent MCP server refs by @pallakatos in #482

Full Changelog: v0.1.24...v0.1.25